Subject: authentication and debug messages.

From: Markus Friedl <[email-masked]>
Date: Fri, 14 Sep 2001 21:22:11 +0200

hi,

are messages of type SSH_MSG_DEBUG allowed during authentication?

can I replay to a SSH_MSG_USERAUTH_REQUEST message with SSH_MSG_DEBUG
and SSH_MSG_USERAUTH_FAILURE?

our server currenlty sends debug messages during public key
authentication, some clients seem to consider this as protocol
violations. i'm not sure how to interpret the drafts, they are not
clear about when SSH_MSG_DEBUG messages are allowed.

e.g. the userauth draft states:

        The server MUST respond with SSH_MSG_USERAUTH_SUCCESS (if
        no more authentications are needed), or SSH_MSG_USERAUTH_FAILURE
        (if the request failed, or more authentications are needed).

so it seems SSH_MSG_DEBUG is not allowed at this point.
should SSH_MSG_DEBUG be allowed? at least it would help
debugging authentication problems....

-m

---

From: "Joseph Galbraith" <[email-masked]>
Date: Fri, 14 Sep 2001 14:24:37 -0600

> debugging authentication problems....

Hmmm... I would think that higher protocol layers shouldn't
be able to constrain lower protocol layers -- which would
mean the DEBUG messages can be sent at any time which
the transport draft allows them.

Similarly, IGNORE messages, or even key exchange messages,
should be allowed at anytime the transport draft allows them,
regardless of what service is running, or what state it is in.

In fact, for the most part, I think the service, such as userauth
and connection, are supposed to be pretty ignorant of the
transport -- if you think about it, the connection service
really isn't tied to the ssh transport, and could run over
another transport if someone wanted to.

- Joseph Galbraith
[email-masked]

---

From: Markus Friedl <[email-masked]>
Date: Sat, 15 Sep 2001 10:51:59 +0200

> the transport draft allows them.

yes, this is what i think, but it get reports that 3.0.x from
ssh.com complains about protocol violations if i send
SSH_MSG_DEBUG during authentication.

-m

---

From: Andrew Brown <[email-masked]>
Date: Sat, 15 Sep 2001 06:59:12 -0400

>SSH_MSG_DEBUG during authentication.

off the top of my head, i'd expect that SSH_MSG_DEBUG messages should
be allowed at any point.

-- 
|-----< "CODE WARRIOR" >-----|
[email-masked]             * "ah!  i see you have the internet
[email-masked] (Andrew Brown)                that goes *ping*!"
[email-masked]       * "information is power -- share the wealth."

---

From: [email-masked] (Sami J. Lehtinen)
Date: 15 Sep 2001 16:53:24 +0300

> SSH_MSG_DEBUG during authentication.

That is a bug, then.

-- 
[[email-masked]          --  Sami J. Lehtinen  --           [email-masked]]
[work:+358 20 5007425][gsm:+358 40 864 3001][http://www.iki.fi/~sjl]
[SSH Communications Security Corp               http://www.ssh.com/]

---

From: [email-masked] (Niels Möller)
Date: 17 Sep 2001 09:50:23 +0200

> off the top of my head, i'd expect that SSH_MSG_DEBUG messages should

I agree.

/Niels